CVE-2025-46080 Details
Description
HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server.
A file upload vulnerability has been identified in HuoCMS version 3.5.1. This issue allows attackers to bypass whitelist restrictions and upload malicious files with specific suffixes, potentially leading to unauthorized control over the server. The vulnerability arises because the application does not properly validate file suffixes before processing uploads.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 29, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yggcwhat/CVE-2025-46080/ | [email protected] | ExploitThird Party Advisory |
| https://github.com/yggcwhat/test2/blob/main/README.md | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| huocms huocms | 3.5.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2025 | Initial Analysis | [email protected] |
| May 29, 2025 | CVE Modified | CISA-ADP |
| May 29, 2025 | New CVE Received | [email protected] |